diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7a4c39..b873975 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   puppet:
     name: Puppet
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 73be88d..eacd0b3 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -8,6 +8,10 @@ name: "Pull Request Labeler"
 on:
   pull_request_target: {}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   labeler:
     permissions:
diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
new file mode 100644
index 0000000..2e3cc68
--- /dev/null
+++ b/.github/workflows/prepare_release.yml
@@ -0,0 +1,27 @@
+---
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
+name: 'Prepare Release'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Module version to be released. Must be a valid semver string without leading v. (1.2.3)'
+        required: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release_prep:
+    uses: 'voxpupuli/gha-puppet/.github/workflows/prepare_release.yml@v3'
+    with:
+      version: ${{ github.event.inputs.version }}
+      allowed_owner: 'voxpupuli'
+    secrets:
+      # Configure secrets here:
+      #  https://docs.github.com/en/actions/security-guides/encrypted-secrets
+      github_pat: '${{ secrets.PCCI_PAT_RELEASE_PREP }}'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4adf65c..0a8b1b1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Release
@@ -21,10 +24,3 @@ jobs:
       #  https://docs.github.com/en/actions/security-guides/encrypted-secrets
       username: ${{ secrets.PUPPET_FORGE_USERNAME }}
       api_key: ${{ secrets.PUPPET_FORGE_API_KEY }}
-
-  create-github-release:
-    name: Create GitHub Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create GitHub release
-        uses: voxpupuli/gha-create-a-github-release@v1
diff --git a/.msync.yml b/.msync.yml
index ac84b45..cf1792b 100644
--- a/.msync.yml
+++ b/.msync.yml
@@ -2,4 +2,4 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-modulesync_config_version: '9.3.0'
+modulesync_config_version: '10.1.0'
diff --git a/Gemfile b/Gemfile
index 0769fcd..028a647 100644
--- a/Gemfile
+++ b/Gemfile
@@ -4,10 +4,8 @@
 source ENV['GEM_SOURCE'] || 'https://rubygems.org'
 
 group :test do
-  gem 'voxpupuli-test', '~> 9.0',   :require => false
-  gem 'coveralls',                  :require => false
-  gem 'simplecov-console',          :require => false
-  gem 'puppet_metadata', '~> 4.0',  :require => false
+  gem 'voxpupuli-test', '~> 11.0',  :require => false
+  gem 'puppet_metadata', '~> 5.0',  :require => false
   gem 'ruby-augeas',                :require => false
 end
 
@@ -17,17 +15,15 @@ group :development do
 end
 
 group :system_tests do
-  gem 'voxpupuli-acceptance', '~> 3.0',  :require => false
+  gem 'voxpupuli-acceptance', '~> 4.0',  :require => false
 end
 
 group :release do
-  gem 'voxpupuli-release', '~> 3.0',  :require => false
+  gem 'voxpupuli-release', '~> 4.0',  :require => false
 end
 
 gem 'rake', :require => false
-gem 'facter', ENV['FACTER_GEM_VERSION'], :require => false, :groups => [:test]
 
-puppetversion = ENV['PUPPET_GEM_VERSION'] || [">= 7.24", "< 9"]
-gem 'puppet', puppetversion, :require => false, :groups => [:test]
+gem 'openvox', ENV.fetch('OPENVOX_GEM_VERSION', [">= 7", "< 9"]), :require => false, :groups => [:test]
 
 # vim: syntax=ruby
diff --git a/Rakefile b/Rakefile
index a7c9aca..16a37c6 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1,30 +1,22 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-# Attempt to load voxpupuli-test (which pulls in puppetlabs_spec_helper),
-# otherwise attempt to load it directly.
 begin
   require 'voxpupuli/test/rake'
 rescue LoadError
-  begin
-    require 'puppetlabs_spec_helper/rake_tasks'
-  rescue LoadError
-  end
+  # only available if gem group test is installed
 end
 
-# load optional tasks for acceptance
-# only available if gem group releases is installed
 begin
   require 'voxpupuli/acceptance/rake'
 rescue LoadError
+  # only available if gem group acceptance is installed
 end
 
-# load optional tasks for releases
-# only available if gem group releases is installed
 begin
   require 'voxpupuli/release/rake_tasks'
 rescue LoadError
-  # voxpupuli-release not present
+  # only available if gem group releases is installed
 else
   GCGConfig.user = 'voxpupuli'
   GCGConfig.project = 'puppet-augeasproviders_base'
diff --git a/metadata.json b/metadata.json
index 8fbb27f..63b8c6b 100644
--- a/metadata.json
+++ b/metadata.json
@@ -40,8 +40,8 @@
   ],
   "requirements": [
     {
-      "name": "puppet",
-      "version_requirement": ">= 7.0.0 < 9.0.0"
+      "name": "openvox",
+      "version_requirement": ">= 8.19.0 < 9.0.0"
     }
   ]
 }
diff --git a/spec/support/spec/psh_fixtures.rb b/spec/support/spec/psh_fixtures.rb
new file mode 100644
index 0000000..5c6c319
--- /dev/null
+++ b/spec/support/spec/psh_fixtures.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+def fixtures(*rest)
+  File.join('spec', 'fixtures', *rest)
+end
+
+# Returns the path to your relative fixture dir. So if your spec test is
+# <project>/spec/unit/facter/foo_spec.rb then your relative dir will be
+# <project>/spec/fixture/unit/facter/foo
+def my_fixture_dir
+  callers = caller
+  while (line = callers.shift)
+    next unless (found = line.match(%r{/spec/(.*)_spec\.rb:}))
+
+    return fixtures(found[1])
+  end
+  raise "sorry, I couldn't work out your path from the caller stack!"
+end
+
+# Given a name, returns the full path of a file from your relative fixture
+# dir as returned by my_fixture_dir.
+def my_fixture(name)
+  file = File.join(my_fixture_dir, name)
+  raise "fixture '#{name}' for #{my_fixture_dir} is not readable" unless File.readable? file
+
+  file
+end